Trusts
Requires the ad-trust module. The Trusts page shows and fine-tunes an established AD trust, including trust type, trusted domains, UPN suffixes and SID blocklists, plus the NetBIOS name and fallback primary group in the global config. Creating the trust is CLI work.
This page covers the Trusts and Trusts global config pages under IPA Server. It requires the ad-trust module. The Trusts page lists trusts established with AD forests, one entry per forest root domain. Creating, verifying and removing a trust is done on the CLI (ipa trust-add, trust-fetch-domains, trust-del); see AD trust prerequisites. This page is for state and details.
Trust detail
| Field | Meaning |
|---|---|
| Realm name | DNS name of the AD forest root |
| Domain NetBIOS name | AD's short name, the DOMAIN in DOMAIN\user |
| Trust type | Active Directory domain, the only supported type |
| Trust direction | One-way (IPA trusts AD, AD users log in to Linux) or two-way. One-way is what 1.0.2 was validated with |
| Alternative UPN suffixes | When AD logins carry a suffix other than the domain (user@corp.com while the domain is ad.corp.local), corp.com is listed here; otherwise sssd cannot tell which trusted domain the user belongs to |
| SID blocklist incoming, SID blocklist outgoing | SIDs ignored when they appear in the PAC of an AD user's ticket. The default list is Windows' well-known SIDs (S-1-5-*); do not empty it |
The Trusted domains tab lists the child domains discovered in the forest, each with its own enable and disable; a disabled child's users cannot log in to Linux. A new child domain in the forest appears only after ipa trust-fetch-domains <forest>.
Trusts global config
| Field | Meaning |
|---|---|
| Domain, Security identifier, NetBIOS name, Domain GUID | The IPA domain's own identity as a Windows domain, generated by ipa-adtrust-install. The NetBIOS name is the IPA short name AD sees |
| Fallback primary group | The group given to AD users on Linux when their AD primary group has no mapping; shipped as Default SMB Group. Never point it at a privileged group such as admins |
| IPA AD trust agents, IPA AD trust controllers | Which IPA servers handle the trust. Controllers run Samba and can create trusts; agents only resolve AD users. A replica becomes an agent through ipa-adtrust-install --add-agents |
Checking the trust
ipa trust-show ad.ipa.test
ipa trust-fetch-domains ad.ipa.test # also refreshes the child domain list
id jdoe@ad.ipa.test # resolve an AD user on any IPA server
getent group 'linux-admins@ad.ipa.test'If id fails while trust-show is fine, check sssd's domain/linux.ipa.test log on the IPA server and the DNS forward zone.
Boundaries
| Topic | Notes |
|---|---|
| ID range type | ipa-ad-trust (computed) or ipa-ad-trust-posix (reading AD's POSIX attributes) is fixed at creation. See ID ranges |
| Reverse login | IPA users cannot log in to Windows through the trust. A one-way trust serves AD users on Linux only |
| Expired licence | The trust does not break; AD users keep logging in. Only this page goes read-only |
Role-based access control (RBAC)
Delegating administration through the permission, privilege and role layers, what the shipped roles can do, giving a help desk a reset-password-only account, and how the admins group relates to RBAC.
ID ranges
How the local range and each trusted domain's range decide uid and gid, what the range types mean, how an AD user's uid is derived from its SID, and why a range cannot be edited freely later.